Data Processing Addendum
Effective: July 19, 2026
This Data Processing Addendum ("DPA") supplements the Terms of Service between you (the "Controller") and Sortly Inc. ("Sortly," the "Processor") when Sortly processes personal data on your behalf under GDPR / UK GDPR / CCPA.
1. Subject matter and duration
Sortly processes personal data (Drive metadata, file content excerpts, contact info) to provide the Service for the duration of the customer’s subscription and any retention period defined in the Privacy Policy.
2. Nature and purpose of processing
Reading, indexing, describing, and reorganising the Controller’s files stored in third-party cloud storage services.
3. Categories of data
Names, email addresses, file names + metadata, file content excerpts (unless metadata-only mode is enabled), payment records.
4. Sub-processors
Sortly uses Google (Drive API), Stripe (payments), OpenRouter/OpenAI (LLM), and SendGrid (email). The Controller consents to this list; updates will be communicated with 30 days’ notice.
5. Security measures
Encryption in transit (TLS), encryption of session cookies, bcrypt password hashing, minimum-privilege OAuth scopes, security headers (CSP, HSTS), rate limiting on auth endpoints, audit logging of admin actions. Full description available on request.
6. Data subject rights
The Controller may exercise Data Subject rights (access, correction, deletion, portability) via the Settings page or by emailing privacy@example.com.
7. International transfers
Where personal data is transferred outside the EU/UK, Sortly relies on the EU Standard Contractual Clauses (2021 controller-to-processor module) and the UK IDTA where applicable.
8. Breach notification
Sortly will notify the Controller of a personal data breach affecting the Controller’s data without undue delay, and within 72 hours where legally required.
9. Return / deletion of data
Upon termination, the Controller may export data as JSON. Data is deleted from active systems within 30 days and from backups within 90 days.
This is a placeholder DPA. Have it reviewed and executed by counsel before offering it to enterprise customers.